That's all true, but continually talking about what a hard problem it is as a way to avoid settling on some harsh penalties (financial or custodial) for negligence of various types only perpetuates the problem. Courts can decide whether a harsh punishment should actually apply in any given case. But right now, no such punishments are even defined so there are no strong incentives to minimize negligence and restrict collection and distribution of that information.

tl;dr penal incentives function like a sword of Damocles. As long as we're debating whether and what size of sword of sword to hang from a thread, Damocles has no reason to worry.